1. 12 10月, 2017 21 次提交
  2. 10 10月, 2017 2 次提交
    • L
      KVM: MMU: always terminate page walks at level 1 · 829ee279
      Ladi Prosek 提交于
      is_last_gpte() is not equivalent to the pseudo-code given in commit
      6bb69c9b ("KVM: MMU: simplify last_pte_bitmap") because an incorrect
      value of last_nonleaf_level may override the result even if level == 1.
      
      It is critical for is_last_gpte() to return true on level == 1 to
      terminate page walks. Otherwise memory corruption may occur as level
      is used as an index to various data structures throughout the page
      walking code.  Even though the actual bug would be wherever the MMU is
      initialized (as in the previous patch), be defensive and ensure here
      that is_last_gpte() returns the correct value.
      
      This patch is also enough to fix CVE-2017-12188.
      
      Fixes: 6bb69c9b
      Cc: stable@vger.kernel.org
      Cc: Andy Honig <ahonig@google.com>
      Signed-off-by: NLadi Prosek <lprosek@redhat.com>
      [Panic if walk_addr_generic gets an incorrect level; this is a serious
       bug and it's not worth a WARN_ON where the recovery path might hide
       further exploitable issues; suggested by Andrew Honig. - Paolo]
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      829ee279
    • L
      KVM: nVMX: update last_nonleaf_level when initializing nested EPT · fd19d3b4
      Ladi Prosek 提交于
      The function updates context->root_level but didn't call
      update_last_nonleaf_level so the previous and potentially wrong value
      was used for page walks.  For example, a zero value of last_nonleaf_level
      would allow a potential out-of-bounds access in arch/x86/mmu/paging_tmpl.h's
      walk_addr_generic function (CVE-2017-12188).
      
      Fixes: 155a97a3Signed-off-by: NLadi Prosek <lprosek@redhat.com>
      Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
      fd19d3b4
  3. 09 10月, 2017 1 次提交
  4. 08 10月, 2017 3 次提交
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 85b1bb24
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
      
       - a couple of serious fixes: use after free and blacklist for WRITE
         SAME
      
       - one error leg fix: write_pending failure
      
       - one user experience problem: do not override max_sectors_kb
      
       - one minor unused function removal
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: ibmvscsis: Fix write_pending failure path
        scsi: libiscsi: Remove iscsi_destroy_session
        scsi: libiscsi: Fix use-after-free race during iscsi_session_teardown
        scsi: sd: Do not override max_sectors_kb sysfs setting
        scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
      85b1bb24
    • L
      Merge branch 'i2c/for-current-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 67936a41
      Linus Torvalds 提交于
      Pull i2c fixes from Wolfram Sang:
       "I2C has three driver fixes for the newly introduced drivers and one ID
        addition for the i801 driver"
      
      * 'i2c/for-current-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: i2c-stm32f7: make structure stm32f7_setup static const
        i2c: ensure termination of *_device_id tables
        i2c: i801: Add support for Intel Cedar Fork
        i2c: stm32f7: fix setup structure
      67936a41
    • L
      Merge tag 'mmc-v4.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 031b8140
      Linus Torvalds 提交于
      Pull MMC fixes from Ulf Hansson:
       "MMC core:
      
         - Fix driver strength selection when selecting hs400es
      
         - Delete bounce buffer handling:
      
           This change fixes a problem related to how bounce buffers are being
           allocated. However, instead of trying to fix that, let's just
           remove the mmc bounce buffer code altogether, as it has practically
           no use.
      
        MMC host:
      
         - meson-gx: A couple of fixes related to clock/phase/tuning
      
         - sdhci-xenon: Fix clock resource by adding an optional bus clock"
      
      * tag 'mmc-v4.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-xenon: Fix clock resource by adding an optional bus clock
        mmc: meson-gx: include tx phase in the tuning process
        mmc: meson-gx: fix rx phase reset
        mmc: meson-gx: make sure the clock is rounded down
        mmc: Delete bounce buffer handling
        mmc: core: add driver strength selection when selecting hs400es
      031b8140
  5. 07 10月, 2017 11 次提交
    • L
      Merge tag 'hwmon-for-linus-v4.14-rc4' of... · 1c86f2e4
      Linus Torvalds 提交于
      Merge tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fix from Guenter Roeck:
       "Fix up error path in xgene driver"
      
      * tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()'
      1c86f2e4
    • L
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · dbeb1a8f
      Linus Torvalds 提交于
      Pull clk fixes from Stephen Boyd:
      
       - build fix to export the clk_bulk_prepare() symbol
      
       - suspend fix for Samsung Exynos SoCs where we need to keep clks on
         across suspend
      
       - two critical clk markings for clks that shouldn't ever turn off on
         Rockchip SoCs
      
       - a fix for a copy-paste mistake on Rockchip rk3128 causing some clks
         to touch the same bit and trample over one another
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
        clk: Export clk_bulk_prepare()
        clk: rockchip: add sclk_timer5 as critical clock on rk3128
        clk: rockchip: fix up rk3128 pvtm and mipi_24m gate regs error
        clk: rockchip: add pclk_pmu as critical clock on rk3128
      dbeb1a8f
    • L
      Merge tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · ed0f72f4
      Linus Torvalds 提交于
      Pull ARC udpates from Vineet Gupta:
      
       - updates for various platforms
      
       - boot log updates for upcoming HS48 family of cores (dual issue)
      
      * tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [plat-hsdk]: Add reset controller node to manage ethernet reset
        ARC: [plat-hsdk]: Temporary fix to set CPU frequency to 1GHz
        ARC: fix allnoconfig build warning
        ARCv2: boot log: identify HS48 cores (dual issue)
        ARC: boot log: decontaminate ARCv2 ISA_CONFIG register
        arc: remove redundant UTS_MACHINE define in arch/arc/Makefile
        ARC: [plat-eznps] Update platform maintainer as Noam left
        ARC: [plat-hsdk] use actual clk driver to manage cpu clk
        ARC: [*defconfig] Reenable soft lock-up detector
        ARC: [plat-axs10x] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-hsdk] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-axs103] Add temporary quirk to reset ethernet IP
      ed0f72f4
    • L
      Merge tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · eab26ad1
      Linus Torvalds 提交于
      Pull xfs fixes from Darrick Wong:
      
       - fix a race between overlapping copy on write aio
      
       - fix cow fork swapping when we defragment reflinked files
      
      * tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: handle racy AIO in xfs_reflink_end_cow
        xfs: always swap the cow forks when swapping extents
      eab26ad1
    • L
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 17d084c8
      Linus Torvalds 提交于
      Pull block fixes from Jens Axboe:
       "A collection of fixes for this series. This contains:
      
         - NVMe pull request from Christoph, one uuid attribute fix, and one
           fix for the controller memory buffer address for remapped BARs.
      
         - use-after-free fix for bsg, from Benjamin Block.
      
         - bcache race/use-after-free fix for a list traversal, fixing a
           regression in this merge window. From Coly Li.
      
         - null_blk change configfs dependency change from a 'depends' to a
           'select'. This is a change from this merge window as well. From me.
      
         - nbd signal fix from Josef, fixing a regression introduced with the
           status code changes.
      
         - nbd MAINTAINERS mailing list entry update.
      
         - blk-throttle stall fix from Joseph Qi.
      
         - blk-mq-debugfs fix from Omar, fixing an issue where we don't
           register the IO scheduler debugfs directory, if the driver is
           loaded with it. Only shows up if you switch through the sysfs
           interface"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        bsg-lib: fix use-after-free under memory-pressure
        nvme-pci: Use PCI bus address for data/queues in CMB
        blk-mq-debugfs: fix device sched directory for default scheduler
        null_blk: change configfs dependency to select
        blk-throttle: fix possible io stall when upgrade to max
        MAINTAINERS: update list for NBD
        nbd: fix -ERESTARTSYS handling
        nvme: fix visibility of "uuid" ns attribute
        bcache: use llist_for_each_entry_safe() in __closure_wake_up()
      17d084c8
    • L
      Merge tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 80cf1f8c
      Linus Torvalds 提交于
      Pull PCI fixes from Bjorn Helgaas:
       "Fix legacy IDE probe issues exposed by recent PCI core IRQ mapping
        changes (Bartlomiej Zolnierkiewicz, Lorenzo Pieralisi)"
      
      * tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        ide: fix IRQ assignment for PCI bus order probing
        ide: pci: free PCI BARs on initialization failure
        ide: free hwif->portdev on hwif_init() failure
      80cf1f8c
    • L
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 27549068
      Linus Torvalds 提交于
      Pull arm64 fixes from Catalin Marinas:
      
       - Bring initialisation of user space undefined instruction handling
         early (core_initcall) since late_initcall() happens after modprobe in
         initramfs is invoked. Similar fix for fpsimd initialisation
      
       - Increase the kernel stack when KASAN is enabled
      
       - Bring the PCI ACS enabling earlier via the
         iort_init_platform_devices()
      
       - Fix misleading data abort address printing (decimal vs hex)
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: Ensure fpsimd support is ready before userspace is active
        arm64: Ensure the instruction emulation is ready for userspace
        arm64: Use larger stacks when KASAN is selected
        ACPI/IORT: Fix PCI ACS enablement
        arm64: fix misleading data abort decoding
      27549068
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 8d473320
      Linus Torvalds 提交于
      Pull KVM fixes from Radim Krčmář:
      
       - fix PPC XIVE interrupt delivery
      
       - fix x86 RCU breakage from asynchronous page faults when built without
         PREEMPT_COUNT
      
       - fix x86 build with -frecord-gcc-switches
      
       - fix x86 build without X86_LOCAL_APIC
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: add X86_LOCAL_APIC dependency
        x86/kvm: Move kvm_fastop_exception to .fixup section
        kvm/x86: Avoid async PF preempting the kernel incorrectly
        KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
      8d473320
    • L
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · d109d83f
      Linus Torvalds 提交于
      Pull rdma fixes from Doug Ledford:
       "This is a pretty small pull request. Only 6 patches in total. There
        are no outstanding -rc patches on the mailing list after this pull
        request, so only if some new issues are discovered in the remainder of
        the rc cycles will you hear from me again.
      
        Summary:
         - a fix for iwpm netlink usage
         - a fix for error unwinding in mlx5
         - two fixes to vlan handling in qedr
         - a couple small i40iw fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        i40iw: Fix port number for query QP
        i40iw: Add missing memory barriers
        RDMA/qedr: Parse vlan priority as sl
        RDMA/qedr: Parse VLAN ID correctly and ignore the value of zero
        IB/mlx5: Fix label order in error path handling
        RDMA/iwpm: Properly mark end of NL messages
      d109d83f
    • L
      Merge branch 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · bf2db0b9
      Linus Torvalds 提交于
      Pull btrfs fixes from David Sterba:
       "Two more fixes for bugs introduced in 4.13.
      
        The sector_t problem with 32bit architecture and !LBDAF config seems
        serious but the number of affected deployments is hopefully low.
      
        The clashing status bits could lead to a confusing in-memory state of
        the whole-filesystem operations if used with the quota override sysfs
        knob"
      
      * 'for-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix overlap of fs_info::flags values
        btrfs: avoid overflow when sector_t is 32 bit
      bf2db0b9
    • L
      Merge tag 'ceph-for-4.14-rc4' of git://github.com/ceph/ceph-client · b77779b9
      Linus Torvalds 提交于
      Pull ceph fixes from Ilya Dryomov:
       "Two fixups for CephFS snapshot-handling patches in -rc1"
      
      * tag 'ceph-for-4.14-rc4' of git://github.com/ceph/ceph-client:
        ceph: fix __choose_mds() for LSSNAP request
        ceph: properly queue cap snap for newly created snap realm
      b77779b9
  6. 06 10月, 2017 2 次提交